feat(serve): ACP/REST parity — 29 new methods + production hardening

Rebased on daemon_mode_b_main (post #4563 merge). Adds all wave 1+2
methods in a single commit:

- Session (6): recap, btw, shell, detach, context_usage, tasks
- Memory (2): workspace/memory read + write (1MB limit, scope/mode validation)
- Files (7): read, read_bytes, stat, list, glob, write, edit (via WorkspaceFileSystem)
- Auth (4): status, device_flow start/get/cancel (projected, no verification leak)
- Workspace (5): tools, mcp/tools, mcp/servers add/remove, sessions/delete (100 cap, dedup)
- Agents (5): list, get, create, update, delete (SubagentManager)

Production hardening:
- toRpcError: FsError, MemoryError, AuthError, SubagentError → structured errorKind
- Error data propagation: catch blocks forward data to JSON-RPC error frames
- BTW_MAX_INPUT_LENGTH validation, shell audit logging
- sessions/delete: 100 cap + dedup + strict types + error preservation
- auth/status: verification material stripped (security)

Generated with AI

Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>

Author: 秦奇